MITRE D3FENDdefensive technique

D3-PHDURA Per Host Download-Upload Ratio Analysis

Official page ↗
Tactic
Detect

Definition

Detecting anomalies that indicate malicious activity by comparing the amount of data downloaded versus data uploaded by a host.

How it works

How it works Aggregate pull vs. push ratios from metadata are used to develop a baseline for a given host over a specific time period, e.g., over a three-hour period, one day, one week, etc. Anomalies identified over a threshold produce an alert. Considerations Collection and analysis of large network packet captures requires large storage and intensive computing power. The time windows used to calculate the ratio may vary in implementations, this consideration should take into account a threat model and likely effects (impacts) delivered by an adversary.

Related

Counters · MITRE ATT&CK (104)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1557.003 DHCP Spoofing sub-technique
  • T0888 Remote System Information Discovery technique
  • T0886 Remote Services technique
  • T1542.005 TFTP Boot sub-technique
  • T1205.001 Port Knocking sub-technique
  • T0814 Denial of Service technique
  • T0817 Drive-by Compromise technique
  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0830 Adversary-in-the-Middle technique
  • T0840 Network Connection Enumeration technique
  • T0842 Network Sniffing technique
  • T0846 Remote System Discovery technique
  • T0848 Rogue Master technique
  • T0865 Spearphishing Attachment technique
  • T0866 Exploitation of Remote Services technique
  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique
  • T0885 Commonly Used Port technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
Show all 104 ›

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

References